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Abstract. In this note, we provide the first 22-step collisions for SHA-256 and SHA-512. Detailed technique 
of generating these collisions will be provided in the next revision of this note. 

1 Introduction 

SHA-256 and SHA-512 are the next generation hash functions designed and standardized by NIST in 
2002 p_j. In this note, we provide message pairs colliding for 22-step SHA-256 and 22-step SHA-512. 
This is the first attack on 22-step SHA-2 family. The success probability of our attack is around 2 -5 in 
average case and around 2 -9 in the worst case. Both these probability figures are experimental. Details 
of the attack will be provided in the next revision of this note. 



2 Message pairs colliding for 22-step SHA-2 



Table 1. Colliding message pair for 22-step SHA-256 with standard IV. These message pairs follow the 
differential path given in Table [3j 



Wi 


0-7 
8-15 


a0263fa5 


707425fb 


618cd8d2 


7d58f729 


Ieb9a964 


19f88f lc 


34e35071 


f28d40e3 


b43e29b8 


1871a949 


e2e01390 


aaf3823e 


8d41a28e 


7f22ee02 


7c625999 


183e603f 


w 2 


0-7 
8-15 


a0263fa5 


707425fb 


618cd8d2 


7d58f729 


Ieb9a964 


19f88f lc 


34e35071 


f28d40e3 


b43e29b9 


1871a948 


defe7410 


aaf5223e 


8d41a28e 


7f22ee02 


7c625999 


00000000 



Table 2. Colliding message pair for 22-step SHA-512 with standard IV. 



Wi 


0-3 


3ffb91948b327337 


95f3c893b2356b98 


506c68760abf51e9 


f ab877b7eef3aaa2 




4-7 


55d5b38ec34340cf 


daa006ef3f677afa 


a5a01d9f Ic67d9c8 


5b219ee6f447480b 




8-11 


52af39ff lecfb48e 


5cff9ae5d4d60a40 


db6cla412c9b4d4d 


aaf3823c2a004blf 




12-15 


8d41a28b0d847693 


7f212e01c4e96937 


7eeeca5c84ba3bda 


Iacadl03aa814e0e 




0-3 


3ffb91948b327337 


95f3c893b2356b98 


506c68760abf51e9 


f ab877b7eef3aaa2 




4-7 


55d5b38ec34340cf 


daa006ef3f677afa 


a5a01d9f Ic67d9c8 


5b219ee6f447480b 




8-11 


52af39ff lecfb48f 


5cff9ae5d4d60a3f 


db687a412dlb4d65 


aaf3623c2a004b07 




12-15 


8d41a28b0d847693 


7f212e01c4e96937 


7eeeca5c84ba3bda 


0000000000000000 



* This author is supported by the Ministry of Information Technology, Govt, of India. 



Table 3. Differential path followed by the message pairs given in Table [TJ The differential path for the 
message pair of Table [2] is different but similar looking. If the register values for the first message W\ 
are denoted by {aj, bi,...hi} and those for the second message W2 are denoted by {a[, b' { , . . . h^}, then 
5X stands for X' — X, where X could be any register value. The 22 steps are indexed from to 21. 



Step 


Sat 


5h 


Sci 


Sdi 


Sa 


Sfi 


5gi 


Shi 
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